Blue Coat’s position as a Certificate Authority, and what it means for you.

Recently, Blue Coat Systems has been approved as an intermediate certificate authority. If you aren’t versed in network security, this means nothing to you. However, be assured that it is a big deal.

Blue Coat is primarily known as  a vendor of application-layer (deep packet inspection) firewalls. In other words, they help people sniff your data — primarily in order to censor the Internet. Maybe your company’s firewall blocks access to YouTube and Facebook while you’re at work. That’s no big deal — Blue Coat delivers something a bit more sinister.

Countries such as Burma, Syria, Bahrain, China, Egypt, Kuwait, Russia, and Saudi Arabia have utilized Blue Coat’s products (or similar offerings) to enable Internet censorship and tracking. This is not a good reputation to carry. However, Blue Coat’s impact has been limited to unencrypted traffic thus far. Now that they are a trusted CA, they’re capable of much more.

In this article, I will give an overview of how our Internet communications are normally secured, then explain why it is a problem that Blue Coat how has this authority.


What is a Certificate Authority?

To encrypt data on the Internet, we use a protocol called Transport Layer Security, or TLS (you might be more familiar an older but similar protocol called SSL, or Secure Sockets Layer). Basically, if a URL starts with https://, then you’re accessing it through TLS; if your browser shows you a green lock icon (or something similar), you can typically be assured that your connection is secure.

A browser will trust a website and display this lock icon if it presents a valid certificate signed by a trusted certificate authority (CA). A certificate is a pretty simple thing — it is essentially just a public key for the website, accompanied by the signature of a CA. Your operating system (or web browser, depending on which one you use) trusts a handful of CAs by default. These are called root CAs. However, root CAs can often delegate the authority to sign certificates to other entities called intermediate CAs. Intermediate CAs don’t have to be explicitly trusted by your computer; the fact that a root CA has vouched for them makes them trusted by extension. Because another CA has vouched for them, Blue Coat is now capable of issuing certificates.

How can a CA be harmful?

To understand Blue Coat’s new role might be harmful, it is important to know a few more details about certificates and how they’re used.

A certificate is always restricted to some domain name (effectively representing a single website). Normally, a CA only gives a website a certificate if it can prove that it is legitimately operating under the name that they have requested; consequently, the certificate is tied to that name and won’t be valid for any other website.

Normally, a rogue website can’t impersonate a legitimate website because it will be unable to obtain a certificate for the website’s domain name. If the rogue site does somehow obtain a certificate, there is essentially no way for a normal user to know they aren’t visiting the legitimate site. We rely on CAs to check that any entity requesting a certificate can prove that it is authorized to represent the domain that it wants a certificate for; this is the entire basis of our security and privacy on the Internet.

Okay, so what?

Since Blue Coat produces hardware and software that enables Internet censorship, we can only imagine how badly they’re itching to be able to sniff our TLS-encrypted Internet traffic to be able to filter it. In order to sniff traffic arbitrarily, they would need to essentially impersonate whatever website you want to reach. Impersonating a website in this way is called a man-in-the-middle (MiTM) attack.

In general, a man-in-the-middle attack works like this:

  • You try to connect to example.com.
  • I intercept your connection so that you connect to my server instead.
  • I act as a middleman between you and example.com, and I am able to filter and manipulate your conversation however I want.

TLS normally prevents this. In the case that TLS is being used, a normal connection would work like this:

  • You try to connect to example.com.
  • Example.com sends you a certificate, signed by some CA.
  • You check to see if the certificate is valid, and decide that it is okay; you then proceed to communicate with example.com.

A MiTM against a TLS-secured website would typically go like this:

  • You try to connect to example.com.
  • I intercept the connection so that you connect to my server instead.
  • I send you a bogus certificate.
  • You look at my certificate and decide it is fake, and disconnect.

This is great; this is what should happen if someone manages to intercept your connection to a website. However, if a company like Blue Coat is a CA, they can actually create a fake certificate in order to pull off the MiTM successfully:

  • You try to connect to example.com.
  • Blue Coat intercepts the connection so that you connect to their server instead.
  • They send you a certificate that looks legitimate, since they have signed it and you trust them as an intermediate CA.
  • You accept the certificate, then proceed to communicate with them instead of the website you intended.
  • Blue Coat can monitor and filter your conversation with example.com however they see fit.

It should be clear why this is a huge problem for security and privacy on the Internet. Essentially, a de-facto lord-of-the-web (a CA) has given Blue Coat free reign to impersonate whatever website they want to. As a result, you can be easily fooled into thinking your connection is secure when really it can be monitored or filtered by a government, corporation, or some other potentially-malicious entity.

What can I do about it?

If you run a website where security and privacy are a concern, you should be employing a mechanism called Key Pinning. This will essentially allow a user’s browser to detect if your site’s purported certificate isn’t signed by the entity you’d expect. It is not foolproof, but will work most of the time unless the user has been subjected to the MiTM ever since their first visit to your site.

If you’re just an end-user, you might want to explicitly distrust Blue Coat. This will essentially tell your computer/browser that despite its certificate being signed by an otherwise-trustworthy CA, you should not trust the certificates that it signs. Apparently, it is pretty easy on OS X but is a little more difficult on Linux because it has a more varied trust ecosystem. I have not yet been able to obtain any information about untrusting the certificate on Windows.

Published by

Travis Mick

Travis is the chief architect of systems and software at Zeall.us. A background in network security research has fostered in him a passion for values such as digital privacy, net neutrality, and intellectual freedom. In a world where these causes are increasingly important, he aims to both raise awareness of them and further their goals through technology.

Leave a Reply